Python 通过pywin32模块调用WindowsAPI接口,实现对特定进程加载模块的枚举输出并检测该PE程序模块所启用的保护方式,此处枚举输出的是当前正在运行进程所加载模块的DLL模块信息,需要用户传入进程PID才可实现输出。
- 首先需要安装两个依赖包:
- pip install pywin32
- pip install pefile
然后再命令行模式下执行命令启动枚举功能。
# By: LyShark
import win32process
import win32api,win32con,win32gui
import os,pefile,argparse
def Banner():
print(" _ ____ _ _ ")
print(" | | _ _/ ___|| |__ __ _ _ __| | __")
print(" | | | | | \___ \| '_ \ / _` | '__| |/ /")
print(" | |__| |_| |___) | | | | (_| | | | < ")
print(" |_____\__, |____/|_| |_|\__,_|_| |_|\_\\")
print(" |___/ \n")
print("E-Mail: [email protected]")
def GetProcessModules(pid):
ModuleList = []
handle = win32api.OpenProcess(win32con.PROCESS_ALL_ACCESS, False, pid )
hModule = win32process.EnumProcessModules(handle)
for item in hModule:
Module_Addr = hex(item)
Module_Path = win32process.GetModuleFileNameEx(handle,item)
Module_Name = os.path.basename(str(Module_Path))
ModuleList.append([Module_Addr,Module_Name,Module_Path])
win32api.CloseHandle(handle)
return ModuleList
def CheckModulesProtect(ClassName):
UNProtoModule = []
if type(ClassName) is str:
handle = win32gui.FindWindow(0,ClassName)
threadpid, procpid = win32process.GetWindowThreadProcessId(handle)
ProcessModule = GetProcessModules(int(procpid))
else:
ProcessModule = GetProcessModules(int(ClassName))
print("-" * 100)
print("映像基址\t\t模块名称\t基址随机化\tDEP保护兼容\t强制完整性\tSEH异常保护")
# By: LyShark.com
print("-" * 100)
for item in ProcessModule:
pe = pefile.PE(item[2])
DllFlage = pe.OPTIONAL_HEADER.DllCharacteristics
print("%10s"%(item[0]),end="\t")
print("%21s"%(item[1]),end="\t")
# 随机基址 => hex(pe.OPTIONAL_HEADER.DllCharacteristics) & 0x40 == 0x40
if( (DllFlage & 64)==64 ):
print(" True",end="\t\t")
else:
print(" False",end="\t\t")
UNProtoModule.append(item[2])
if( (DllFlage & 256)==256 ):
print("True",end="\t\t")
else:
print("False",end="\t\t")
if ( (DllFlage & 128)==128 ):
print("True",end="\t\t")
else:
print("False",end="\t\t")
if ( (DllFlage & 1024)==1024 ):
print("False",end="\t\t\n")
else:
print("True",end="\t\t\n")
print("-" * 100)
print("\n[+] 总模块数: {} 可利用模块: {}".format(len(ProcessModule),len(UNProtoModule)),end="\n\n")
for item in UNProtoModule:
print("[-] {}".format(item))
print("-" * 100)
if __name__ == "__main__":
Banner()
parser = argparse.ArgumentParser()
parser.add_argument("-H","--handle",dest="handle",help="指定一个正在运行的进程Handle")
parser.add_argument("-P","--pid",dest="pid",help="指定一个正在运行的进程PID")
args = parser.parse_args()
if args.handle or args.pid:
if args.handle:
CheckModulesProtect(str(args.handle))
elif args.pid:
CheckModulesProtect(int(args.pid))
else:
parser.print_help()
输出枚举效果如下: